WE CLAIM: 

A computer program product for responding to detection of an outbreak of a 
coi^puter virus on a computer apparatus, said computer program product comprising: 
(i) sequence data defining a sequence containing a plurality of predefined 
actions to be followed upon detection of said outbreak; 
outbreak detection code operable to detect said outbreak; and 
(iir^ sequence following code operable to follow said sequence of 
predefined actions. 

2. A compiker program product as claimed in claim 1, wherein said sequence of 
predefined actions\s user defined. 

3. A computer prb^ram product as defined in claim 1, wherein one or more of 
said predefined actions performed after receipt of a user input confirming said 
predefined action. 

4. A computer program product as claimed in claim 1, wherein said sequence of 
predefined actions varies in dependence upon time of day. 

5. A computer program product ^ claimed in claim 1, wherein said sequence of 
predefined actions varies in dependence\pon day of week. 

6. A computer program product as ciMmed in claim 1, wherein one of said 
predefined actions is reducing virus detection m^tifications. 

7. A computer program product as claimedNin claim 1, wherein one of said 
predefined actions is switching from virus quarantining to virus deletion when a 
computer virus is detected. 



8. A computer program product as claimed in claim 1, wherein one of said 
predefined actions is increasing scan options that control how thoroughly said 
computer system is scanned to detect a computer virus. 
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5 9\ A computer program product as claimed in claim 1, wherein one of said 
predefined actions is sending a copy of said detected computer virus to a remote site 
for ^alysis. 

10. ^AL computer program product as claimed in claim 1, wherein one of said 
10 predefined actions is downloading a latest virus definition file from a remote site. 

11. A computer program product as claimed in claim 1, wherein one of said 
predefined actions is downloading a latest virus definition file from a remote site. 

15 \ 

12. A computer Vo gram product as claimed in claim 1, wherein one of said 
predefined actions is performing a complete virus scan of all computer files stored in 
at least a portion of said computer apparatus. 

20 13. A computer program\product as claimed in claim 1, wherein one of said 
predefined actions is blocking e\mail attachments. 

14. A computer program product as claimed in claim 13, wherein said predefined 
action of blocking e-mail attachments blocks identical attachments appearing in 

25 excess of a threshold level. \ 

15. A computer program product as cKaimed in claim 1, wherein one of said 
predefined actions is rendering non-accessible e-mail distribution lists and e-mail 
address books of e-mail clients coupled to said computer apparatus. 

30 - \ 

16. A computer program product as claimed ifi claim 1, wherein one of said 
predefined actions is restarting in administrator mode an e-mail post office coupled to 
said computer apparatus. \ 

35 17. A computer program product as claimed in clairrryl, wherein one of said 
predefined actions is closing down an e-mail post office coVpled to said computer 
apparatus. \ 
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A method of responding to detection of an outbreak of a computer virus on a 



computer apparatus, said method comprising: 

\ (i) defining a sequence containing a plurality of predefined actions to be 
\ followed upon detection of said outbreak; 

\ii) detecting said outbreak; and 



19. A memod as claimed in claim 18, wherein said sequence of predefined actions 
is user defmedX 

15 20. A method as defined in claim 18, wherein one or more of said predefined 
actions is performed after receipt of a user input confirming said predefined action. 

21. A method as claimed in claim 18, wherein said sequence of predefined actions 
varies in dependence upon time of day. 

20 \ 

22. A method as claimed in claim 18, wherein said sequence of predefined actions 
varies in dependence upon day of week. 

23. A method as claimed in claim ls8, wherein one of said predefined actions is 
25 reducing virus detection notifications. \ 

24. A method as claimed in claim 18, whVein one of said predefined actions is 
switching from virus quarantining to virus deletion when a computer virus is detected. 

30 25. A method as claimed in claim 18, wherein one of said predefined actions is 
increasing scan options that control how thoroughly said computer system is scanned 
to detect a computer virus. \ 

26. A method as claimed in claim 18, wherein one of said predefined actions is 
35 sending a copy of said detected computer virus to a remote site for analysis. 

27. A method as claimed in claim 18, wherein one of said predefined actions is 
dovmloading a latest virus definition file from a remote site. \ 
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(iH) 



following said sequence of predefined actions. 



19 



5 \ 

)28. A method as claimed in claim 18, wherein one of said predefined actions is 
downloading a latest virus definition file from a remote site, 

10 29. \A method as claimed in claim 18, wherein one of said predefined actions is 
performmg a complete virus scan of all computer files stored in at least a portion of 
said computer apparatus. 

30. A method as claimed in claim 18, wherein one of said predefined actions is 
15 blocking e-mail attachments. 

31. A method as (claimed in claim 30, wherein said predefined action of blocking 
e-mail attachments blocks identical attachments appearing in excess of a threshold 
level. 

20 \ 

32. A method as claimedin claim 18, wherein one of said predefined actions is 
rendering non-accessible e-mail\iistribution lists and e-mail address books of e-mail 
clients coupled to said computer apparatus. 

25 33. A method as claimed in claim \8, wherein'one of said predefined actions is 
restarting in administrator mode an e-mail post office coupled to said computer 
apparatus. \ 

34. A method as claimed in claim 18, wherein one of said predefined actions is 
30 closing down an e-mail post office coupled to said cWiputer apparatus. 

^S. Apparatus for responding to detection of an oiit^ak of a computer virus on a 
computer apparatus, said computer program product compfising: 

sequence data storage storing sequence data defining^ sequence containing a 
35 plurality of predefined actions to be followed upon detection of\aid outbreak; 
outbreak detection logic operable to detect said outbreak; and 
sequence following logic operable to follow said sequence of predefined 
actions. \ 
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56. A computer program product as claimed in claim 35, wherein said sequence of 
predefined actions is user defined. 

37. \ A computer program product as defined in claim 35, wherein one or more of 
10 said predefined actions is performed after receipt of a user input confirming said 

predefined action. 

38. A computer program product as claimed in claim 35, wherein said sequence of 
predefined actiVis varies in dependence upon time of day. 

15 \ 

39. A computer^rogram product as claimed in claim 35, wherein said sequence of 
predefined actions vaides in dependence upon day of week. 

40. A computer program product as claimed in claim 35, wherein one of said 
20 predefined actions is reduciW virus detection notifications. 

41. A computer program product as claimed in claim 35, wherein one of said 
predefined actions is switching uom virus quarantining to virus deletion when a 
computer virus is detected. 

25 \ 

42. A computer program product as^claimed in claim 35, wherein one of said 
predefined actions is increasing scan options that control how thoroughly said 
computer system is scanned to detect a compurer virus. 

30 43. A computer program product as claimed rn claim 35, wherein one of said 
predefined actions is sending a copy of said detected\pmputer virus to a remote site 
for analysis. \ 

44. A computer program product as claimed in claim 3^ wherein one of said 
35 predefined actions is downloading a latest virus definition file fi-om a remote site. 

45. A computer program product as claimed in claim 35, whefein one of said 
predefined actions is dovmloading a latest virus definition file fi^om a remote site. 
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v46. A computer program product as claimed in claim 35, wherein one of said 
ptedefmed actions is performing a complete virus scan of all computer files stored in 
at le^st a portion of said computer apparatus. 

47. A\x)mputer program product as claimed in claim 35, wherein one of said 
predefined actions is blocking e-mail attachments. 

4?: A computeisj)rogram product as claimed in claim 46, wherein said predefined 
action of blocking evmail attachments blocks identical attachments appearing in 
excess of a threshold leve 

49^ A computer program ptoduct as claimed in claim 35, wherein one of said 
predefined actions is rendering nbin-accessible e-mail distribution Usts and e-mail 
address books of e-mail clients coupleaao said computer apparatus. 
<^ 

3^ A computer program product as claimed in claim 35, wherein one of said 
predefined actions is restarting in administrator mode an e-mail post office coupled to 
said computer apparatus. 

5^ A computer program product as claimed in claiik 35, wherein one of said 
predefined actions is closing down an e-mail post office cotoled to said computer 
apparatus. 
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